Ibrahim Saud
@tektrixIndiaCompletionist
2 followers18,457 downloads7,056 copies47 likes38,418 views
11,679 detections
Filters
Last updated
All Time
Detection languages
3,760
1,874
1,586
966
944
Categories
4,878
3,246
1,529
1,303
1,122
Platforms
7,678
1,824
1,066
999
986
Products / Services
2,963
1,768
1,278
953
798
MITRE Techniques
3,615
3,555
2,488
1,474
1,186
CVEs
36
27
26
25
23
IDS Classtypes
360
113
38
24
24
IDS Protocols
315
114
93
47
10
Detects OS command execution spawned by a Java process, potentially indicating successful exploitation of Velocity template injection (e.g., in Flowise or Floci) where java.lang.ProcessBuilder is leveraged to execute malicious commands.
This rule monitors for file creations and process executions associated with known proof-of-concept (PoC) artifacts for CVE-2026-55200 (a pre-authentication remote code execution vulnerability in libssh2). It also identifies suspicious child processes spawned from common SSH-related binaries, which may indicate successful exploitation or the execution of malicious payloads.
Detects instances where ImageMagick (convert, mogrify, magick, identify) attempts to execute Ghostscript or shell interpreters. The rule flags suspicious behavior such as spawning shell interpreters, using shell metacharacters or pipes in the command line, or executing Ghostscript from non-standard or potentially writable directory paths, which are indicative of a delegate hijack exploitation attempt for arbitrary command execution.
Detects suspicious network activity using the STUN/TURN protocol on port 3478 initiated by non-browser and non-conferencing processes. The rule specifically targets unsigned processes or those located in user-writable directories (such as Temp or AppData), which are common indicators of Grandoreiro malware sideloading and establishing C2 communication tunnels.
Detects potential unauthorized remote control activity via RustDesk, specifically identifying sessions that spawn child processes (e.g., cmd.exe, powershell.exe) or exhibit behavior indicative of bypassing permission constraints on RustDesk processes not signed by the official publisher.
Detects attempts to perform a container escape using the 'docker cp' command, where a maliciously crafted source path with traversal sequences allows the container daemon to write files outside of the container boundary. The rule monitors for suspicious 'docker cp' command executions and the creation of artifacts associated with known path traversal escape techniques in the host filesystem by the Docker daemon.
This rule monitors for the presence of known exploit harness binaries associated with CVE-2026-55200 on disk or in command lines, and identifies post-exploitation activity where common network utilities (curl, git, php) execute unsigned or suspicious child processes, which often indicates lateral movement or payload staging.
Detects unauthorized attempts by a non-super-administrator user within the MyBB Admin Control Panel to assign the administrator group (usergroup=4) to a new or existing user, exploiting a privilege boundary bypass.
Detects the execution of VBScript files via wscript.exe or cscript.exe from user-writable directories (Temp, Downloads, AppData, etc.) when the process is spawned by common application vectors like web browsers, email clients, or document viewers. This behavior is indicative of the Grandoreiro banking trojan's dropper mechanism, which uses obfuscated VBS scripts for geofencing and locale checks prior to downloading secondary payloads.
This rule monitors DNS traffic for queries to the domain 'chongdaotang.net', which is associated with a phishing campaign leveraging legal threat lures to harvest credentials. Detecting these queries indicates that a host in the network is attempting to resolve a domain used in a known credential harvesting attack.
Page 870 of 1168